chore(deps): Update npm-deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apidevtools/json-schema-ref-parser (source)	15.5.0 → 15.5.1
@modelcontextprotocol/sdk (source)	1.29.0 → 1.30.0
@napi-rs/canvas	1.0.2 → 1.0.3
@redocly/cli	2.40.0 → 2.41.2
express-rate-limit	8.6.0 → 8.6.1
pdfjs-dist (source)	6.1.200 → 6.2.108

---

Release Notes

APIDevTools/json-schema-ref-parser (@​apidevtools/json-schema-ref-parser)

v15.5.1

Compare Source

Bug Fixes

• harden reference resolution and HTTP safety (e8190c1)

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

Compare Source

Brooooooklyn/canvas (@​napi-rs/canvas)

v1.0.3

Compare Source

Bug Fixes

• deps: update rust crate imagesize to 0.15 (#​1290) (2ad119e)
• deps: update rust crate infer to 0.22 (#​1294) (dc3377f)
• shadow: align Canvas2D shadows with Chromium (#​1300) (5646339)
• shadow: apply shadowColor alpha once instead of squaring it (#​1298) (2cd4e1a), closes #​1297

Features

• chrome/m151 (#​1302) (9eb7816)

Redocly/redocly-cli (@​redocly/cli)

v2.41.2

Compare Source

Patch Changes

• Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.

• Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.

  Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.

• Updated @​redocly/openapi-core to v2.41.2.

• Updated @​redocly/respect-core to v2.41.2.

v2.41.1

Compare Source

Patch Changes

• Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator.
  Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch.
  Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
• Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.

v2.41.0

Compare Source

Minor Changes

• Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme.
  The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.

Patch Changes

• Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
• Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
• Updated @​redocly/openapi-core to v2.41.0.
• Updated @​redocly/respect-core to v2.41.0.

express-rate-limit/express-rate-limit (express-rate-limit)

v8.6.1

Compare Source

You can view the changelog here.

mozilla/pdf.js (pdfjs-dist)

v6.2.108

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Adversarial cross-review — Codex gpt-5.6-sol (xhigh)

Run once against origin/main...origin/renovate/npm-deps, steered at supply-chain rather than style risk. 0 findings — no [P1], no [P2].

• The diff is 5 additions / 5 deletions in pnpm-lock.yaml and nothing else. Only express-rate-limit changes identity (8.6.0 → 8.6.1); no other package version, resolution, peer range, or integrity hash moves with it.
• Its resolved dependencies stay debug@4.4.3, express@5.2.1, ip-address@10.4.0; the Express peer range stays >=4.11.
• package.json is untouched and its ^8.5.1 range already admits 8.6.1.
• Both consumers — src/api/router.ts:184 and src/mcp/server.ts:75 — use the default export with unchanged options. Upstream 8.6.1 only deprecates four exported time constants, none of which SpecR references.

Independent supply-chain check (not taken from the diff): the lockfile's new integrity hash was compared against what the registry actually publishes for the version —

registry.npmjs.org/express-rate-limit/8.6.1
integrity: sha512-0D493aP61w0TJ2A0wy27riRsO7FMQ7FK+KUHOKCSfPvYo0R55aiC6emCVgFUeShH0fq0ICPVzNcgoS+BsbXQCA==

— byte-identical to the hash committed here, so the pinned tarball is the published one. Renovate's own stability-days check also reports the minimum release age met.

CI is green on 56e2bc68 (Build, Lint, Test unit+integration, Verify harness, LOC delta). mergeStateStatus is BLOCKED on review-required only — not behind base — so the branch needs no rebase.

🤖 Co-authored by Claude Opus 5 (1M context).

[thewrz]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b4c4bb06-4851-4788-95b6-cd6896ff0def

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}